poc3

suricata/ids-output.yaml

@@ -71,6 +71,8 @@ outputs:
 
   # Bounded forensic capture: only flows that generated an alert are kept.
   # The eight 64 MB files cap disk use at roughly 512 MB inside /data/logs/suricata.
+  # Runtime startup rewrites this block from FORENSIC_PCAP_MODE.
+  # blocks/off disable Suricata PCAP logging; blocks is persisted by the app only after successful RouterOS blocks.
   - pcap-log:
       enabled: yes
       filename: alert.pcap